Choice "A" is correct. Risk assessment procedures must be performed to assess the risk of material misstatement and to determine whether and to what extent further audit procedures are necessary. In addition, the planning process and the overall review stage of the audit must include application of analytical procedures. Tests of the operating effectiveness of controls, however, are only performed when the auditor's risk assessment is based on the assumption that controls are operating effectively, or when substantive procedures alone are insufficient.
Choices "b", "c", and "d" are incorrect, based on the above explanation.